import { checkRoleAccess, type MetaRoleRequirement } from '~/utils/roles'

export default defineNuxtRouteMiddleware(async (to) => {
  const auth = useAuth()

  if ((auth.token.value || auth.tokenState.value) && !auth.user.value && !auth.isSyncingUser.value) {
    try {
      await auth.syncUser({ currentPath: to.path })
    } catch (error) {
      console.error('[Auth Middleware] Sync failed:', error)
      return navigateTo('/auth/login')
    }
  }

  if (!auth.isAuthenticated.value) {
    return navigateTo('/auth/login')
  }

  const requiredRole = to.meta.auth?.role as MetaRoleRequirement | undefined

  if (requiredRole && auth.user.value) {
    const userRole = auth.user.value.role

    if (!checkRoleAccess(userRole, requiredRole)) {
      console.warn(`[Auth] User role '${userRole}' rejected for route requirement:`, requiredRole)
      return navigateTo('/')
    }
  }
})